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We present a fair and optimistic [71 [8] quantum contract signing protocol between two clients that 
requires no communication with the third trusted party during the exchange phase. We discuss 
its fairness and show that it is possible to design such a protocol for which the probability of a 
dishonest client to cheat becomes negligible, and scales as N~^^'^ ^ where N is the number of messages 
exchanged between the clients. Our protocol is not based on the exchange of signed messages: its 
fairness is based on the laws of quantum mechanics. Thus, it is abuse-free 9 , and the clients do 
not have to generate new keys for each message during the Exchange phase. We discuss a real-life 
scenario when the measurement errors and qubit state corruption due to noisy channels occur and 
argue that for real, good enough measurement apparatus and transmission channels, our protocol 
would still be fair. Our protocol could be implemented by today's technology, as it requires in 
essence the same type of apparatus as the one needed for BB84 cryptographic protocol [12]. Finally, 
we briefly discuss two alternative versions of the protocol, one that uses only two states (based 
on B92 protocol [24]) and the other that uses entangled pairs (based on [20 ), and show that it is 
possible to generalize our protocol to an arbitrary number of clients. 



PACS numbers: 03.67.Dd, 03.67.Hk 

I. INTRODUCTION 

Contract signing [T] is an important security task with 
many applications, namely to stock market and others 
[2]. It is a two party protocol between Alice and Bob 
who share a common contract and want to exchange each 
others' commitments to it, thus binding to the terms of 
the contract. Usually, commitment is done by signing 
the contract on the spot. 

With the technology development, situations when 
parties involved are physically far apart become more rel- 
evant every day - distant people can communicate using 
ordinary or e-mail, internet, etc. This poses new chal- 
lenges to the problem. Forcing spatially distant parties 
to exchange signatures opens the possibility of a fraud: 
Bob may get the commitment from Alice (a copy of the 
contract with her signature on it) without committing 
himself, which creates an unfair situation. Indeed, hav- 
ing Alice's commitment enables Bob to appeal to a judge 
to bind the contract (i.e., to enforce; declare it valid), by 
showing Alice's commitment to the contract (together 
with his signature stamped on it). On the other hand, 
although Alice did commit, she cannot prove it (prove 
that she sent her commitment to Bob) and thus cannot 
appeal to a judge. Moreover, she cannot prove that she 
did not receive Bob's commitment, so he can safely claim 
that he behaved honestly and sent his commitment to 
Alice. Note that initially Bob did not commit, but hav- 
ing Alice's commitment puts him in a position to later 
in time choose whether to sign the contract or not, and 
thus bind it or not, while Alice has no power to do either 
of the two. 

This situation is particularly relevant in a stock mar- 
ket, for example, where prices of stocks may range over 



time, but agents must commit beforehand io sell/buy at a 
certain time in the future^ for previously fixed prices. The 
unfairness allows Bob to make risky decisions in the stock 
market without being bound to them, unless he decides 
so. The problem when distant parties wish to commit to 
a common contract lies in the impossibility for an agent, 
say Alice, to prove whether she has indeed committed 
to it or not. Often, the contract signing problem is said 
to be a variant of the so-called return receipt (or certi- 
fied mail) problem^ in which parties involved exchange 
mails between each other asking for the proof confirming 
whether the other side received the message, or not. 

A simple solution to this unfair situation is to have a 
trusted third party (usually referred to as Trent) medi- 
ating the transaction - Alice and Bob send their com- 
mitments to Trent, who then returns the receipts to the 
senders, and performs the message exchange only upon 
receiving both of the commitments. However, Trent's 
time and resources are expensive and should be avoided 
as much as possible. Unfortunately, it has been shown 
that there is no fair and viable contract signing proto- 
col [TJ [3], unless during the signature exchange phase 
the signing parties communicate with a common trusted 
agent, i.e., Trent. By fair protocol we mean that either 
both parties get each other's commitment or none gets. 
By viable protocol we mean that, if both parties behave 
honestly, they will both get each others' commitments. 

The essence of the proof of the above impossibility re- 
sult is rather simple, and is related with the impossibil- 
ity of establishing distributed consensus in asynchronous 
networks [3]. The simple assumption we need for the 
proof is the following: the protocol consists of a number 
of messages exchanged between the two parties, so that 
eventually, upon the termination of the protocol, both 
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Alice and Bob acquire the signature of the other. This 
can be done by either sending pieces of signatures in each 
message, or in a more sophisticated scenarios, by sending 
partial information needed to calculate, upon running a 
complex algorithm, the signature needed [H [5] . We see 
that if such protocol existed, it would have a final step 
where one message is exchanged, say, from Bob to Al- 
ice. In that case, before sending his last message. Bob 
would already have all the information required for him 
to compute Alice's signature of the contract (and Alice 
does not). Therefore, if he does not send the last message, 
the protocol reaches an unfair state. Note the essential 
importance of the asynchronousity - it is not possible for 
distant parties to arrange in advance that messages are 
sent simultaneously. 

One way to come around this difficulty is to consider 
optimistic protocols that do not require communication 
with Trent unless something wrong comes up (some mes- 
sage is missing, etc.) 0. In such protocols, the clients 
contact Trent regarding the given contract before the ac- 
tual signing takes place. Trent notifies the request and 
assigns the particular contract with the clients, this way 
initializing the signing protocol. After that, the clients 
exchange messages between each other such that, if the 
protocol is executed correctly by both sides, both will end 
up with signed messages. In case something goes wrong 
(message that is not according to the protocol is sent, or 
communication interrupted), Trent is contacted in order 
to bind the contract. 

Another workaround is to relax the fairness condition 
probabilistically. Probabilistic fairness allows one agent 
to have at most e more probability of binding the con- 
tract over the other agent, at each step of the protocol. 
In this case, for an arbitrarily small £, classical solutions 
have been found where the number of exchanged mes- 
sages between the agents is minimized [6l [7] . In addition 
to being (probabilistically) fair, in the protocol by Ra- 
bin [6^ the joint probability that one agent can bind the 
contract, while the other cannot, is also always smaller 
than given e. Moreover, the second protocol by Ben- Or 
et. al [7^ satisfies even stronger condition: the conditional 
probability that an agent cannot bind the contract, given 
that the other can, can be made arbitrarily small. Note 
that the two notions are not exclusive: the protocol [7| 
is both fair and optimistic. 

In this paper, we present a (probabilistically) fair 
contract signing protocol where no information with a 
trusted third party (Trent) is exchanged during the ex- 
change phase. This way, it avoids possible communica- 
tion bottlenecks that are otherwise inherent when involv- 
ing Trent. Information exchange takes place during the 
initialization phase and possibly later during the (con- 
tract) binding phase (the protocol is optimistic [8 : Trent 
is rarely asked to bind the contract due to protocol fair- 
ness - cheating does not pay off). Unlike previous clas- 
sical proposals, in our quantum protocol the messages 



exchanged between the clients (Alice and Bob) during 
the exchange phase do not have to be signed. Conse- 
quently, our protocol is abuse-free [9 : a client has no 
proof that (s)he communicated with the other client, at- 
tempting to sign a given contract. In our protocol only 
two signed messages are exchanged. This is very impor- 
tant when one wants to achieve unconditional security. In 
the case of classical protocols, digital pseudo-signatures 
[To] should be used, where key is one-use and expen- 
sive to generate. Finally, our protocol can be used in 
solving some purely quantum protocols involving timely 
decisions between spatially distant parties, such was the 
case of simultaneous dense coding and teleportation ^ . 

In classical cryptography the contract exchange is done 
in the way that respective participants are learning some 
information (signed message, etc.) bit by bit, thus in- 
creasing their knowledge. In order to bind the contract 
they have to present the (complete) information to Trent. 
Our approach is somewhat different, and is based on the 
laws of quantum physics. 

Quantum systems obey the laws of quantum physics, 
which exhibit some counterintuitive features that are 
quite distinct from those of classical physics. The prin- 
ciple of quantum superposition, entanglement and in- 
terference, to name just a few, have found numerous 
applications in the growing field of quantum informa- 
tion and computation, bringing about many advantages 
of quantum-based information processing protocols over 
those using classical systems only. Quantum cryptogra- 
phy [12] [13] guarantees secure communication and de- 
vices based on its principles can be already bought on a 
market today; Shor's algorithm for factoring [14 is expo- 
nentially faster than any known classical counterpart; the 
use of entanglement can in some cases of distributed in- 
formation processing protocols considerably decrease the 
amount of information exchange between distant parties 
needed to perform a given task, thus decreasing (quan- 
tum) communication complexity of the problem [15 and 
can even eliminate any need of communication that is 
classically necessary for achieving a goal of common in- 
terest of separated parties [16] (a feature often referred 
in literature to as pseudo-telepathy) . For an overview of 
the field of quantum information and computation, see 
for example [17 . 

In solving the contract signing problem, we use quan- 
tum complementarity which as a consequence has the im- 
possibility to unambiguously discriminate between two 
quantum states unless they are mutually orthogonal 
[T8| [19] . This fact is at the heart of the security of quan- 
tum cryptographic protocols. In particular, as the setups 
of the famous BB84 quantum key distribution protocol 
[T2] and our contract signing protocol have conceptual 
similarities, so the security of the former is closely related 
to the fairness of the latter. At the end, we show an alter- 
native version of our contract signing protocol that uses 
quantum entanglement, a non-local version of comple- 
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mentarity^. Entanglement provides the possibility of re- 
placing the exchange of classical information with Trent 
during the exchange phase, by establishing the proper 
type of correlations between the distant parties, in a sim- 
ilar fashion as in Ekert's key distribution protocol that 
uses entangled states [2Ql . 

The very same mechanism of commitment to one spe- 
cific choice can be used to establish e.g., a bit commit- 
ment protocol. Note that unconditionally secure bit com- 
mitment is not possible without Trent [2TJ [22] , although 
it is realizable using other assumptions as well. 

The paper is organized as follows. In the next sec- 
tion we present the quantum contract signing protocol 
that requires no communication with Trent during the 
exchange phase, is optimistic and fair. In Section III. 
we present the conditions we require for the protocol to 
be fair. In the Section IV. we discuss its fairness for 
the case of ideal measurements restricted to only two al- 
ternative single-particle observables. In Section V. we 
analyze the case of general multi-particle measurements 
(POVMs) and argue that under the assumption of noisy 
channels and realistic detectors with error rates, it is still 
possible to design a fair protocol. We also discuss alter- 
native protocols that, instead of four states, use either 
two non-orthogonal states, or entangled pairs. Finally, 
we present a generalization to the case of more than two 
agents. In Conclusions we present a short overview of 
the results presented and some of possible future lines of 
research. 



II. THE PROTOCOL 

In order for it to be fair, any contract signing protocol 
has to force a client to make only one out of two possi- 
ble choices - accept or reject the contract. A conceptu- 
ally similar situation occurs in quantum physics, where 
an observer cannot simultaneously measure two comple- 
mentary observables, say the position and the velocity of 
a quantum system. In other words, an observer is forced 
to choose to measure only one out of two possible ob- 
servables and gain information about only one out of two 
physical properties of the system observed. For example, 
by measuring the exact position of a quantum particle, 
we are left with complete uncertainty of its velocity, and 
vice versa (Heisenberg uncertainty relations). 

This basic feature of quantum physics is the essential 
ingredient of our protocol: instead of sending to Trent 
the information that explicitly states the acceptance or 
rejection of the contract, Alice reveals her choice by mea- 



Both quantum complementarity and quantum entanglement 
could be seen as consequences of the Heisenberg uncertainty prin- 
ciple and ultimately, the superposition principle. 



suring one of the two complementary observables, thus 
acquiring information about only one of the two possible 
features of the system given to her by Trent (and the 
same for Bob). Gaining information about one feature 
thus corresponds to the acceptance, while acquiring in- 
formation about the other corresponds to rejection of the 
contract. This information can later be used as a proof 
of client's choice. 

As a client's measurement is local, no information is 
exchanged between a client and Trent, during the ex- 
change phase. Only latter, during the possible binding 
phase, this (classical) information obtained by a client's 
measurement is confronted with Trent's (classical) infor- 
mation of the quantum state in which he prepared the 
quantum system distributed to a client, and thus used as 
verification of client's choice. 

To ensure the timely decisions, Trent provides Alice 
with the classical information of the quantum state in 
which Bob's quantum system is prepared, and vice versa. 
This way, the clients can confront each others' measure- 
ment results with the classical data provided by Trent, 
thus obtaining each others' commitment choices before a 
certain fixed moment in time. Since quantum mechan- 
ics is essentially a probabilistic theory, the clients are 
supplied by a number of systems, giving rise to the prob- 
abilistic fairness of the protocol. 

In our protocol, we use the simplest two-dimensional 
quantum systems called qubits. The complementary ob- 
servables could be seen as spin components (for elec- 
trons), or linear polarizations (for photons), along two 
mutually orthogonal axes. We will denote the two observ- 
ables measured on single qubits as the Accept observable 
A and the Reject observable R. Measuring A corresponds 
to the acceptance, while measuring R corresponds to the 
rejection of the contract. The two observables A and 
R are required to be mutually complementary and are 
given by mutually unbiased bases [18 Ba = {lO)? 
{the Accept basis) and Br = {|— ), |+)} {the Reject ba- 
sis), respectively, such that |±) = (|1) ± |0))/>/2. Both 
observables have the same eigenvalues, and 1, such that 

A = i.|i){i| + o-|o)(o|, 

R = i.|+)(+|+0-|-)(-|. (1) 

During the Initialization phase, Trent randomly prepares 
qubits, each in one of the four states {|0), | — ), |+)}, 
taken from the Accept or the Reject basis. Thus, each 
qubit state G {|0), |— ), |+)} is defined by two clas- 
sical bits C = {Cb^Cs), first of which defines the basis 
{Cb = 1 if 1?/^) G Ba^ while C5 = otherwise) while 
the second defines the particular state from a given basis 
{Cs = 1 if IV^) e {|1), 1+)}, while Cs=0 otherwise). For 
each qubit sent to Alice in a state IV^)*^, Trent sends to 
Bob classical bits C"^ = C{\iIj)'^) assigned to this state, 
and analogously for Bob. 

During the Exchange phase, that might take place 
much later after the Initialization phase, the clients agree 
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upon the actual contract, decide whether to commit to it 
or not, and exchange each others' commitments. On the 
system in the state IV^)"^, Ahce measures either A or 
depending on whether she decides to accept or reject the 
contract, respectively, and then communicates her result 
to Bob. Since the two observables are defined by 
a pair of mutually unbiased bases, the statistics of mea- 
surement results performed on a sequence of qubits each 
of which is randomly prepared in one of the four states 
{|0), |— ), 1+)} will be dramatically different depend- 
ing on which observable is measured. For instance, when 
Alice measures A on qubits prepared in the Accept basis, 
the measurement outcomes are perfectly correlated with 
the corresponding classical bits Cf given to Bob (i.e., 
M-^ = Cf); when she measures A on qubits prepared in 
the Reject basis produces, the results obtained are com- 
pletely uncorrelated with the corresponding classical bits, 
and analogously for R. 

This way, by choosing one of the two measurements 
performed on a sequence of qubits, Alice produces one 
of two mutually exclusive sets of measurement outcomes 
that serve as a signature of her choice (to accept or to 
reject the contract). By sending the results to Bob, she 
informs him of her decision by some fixed moment in time 
to. The same is done by Bob. 

In the Binding phase, each party is asked to confront 
her/his measurement results with the Trent's correspond- 
ing classical bits. The perfect correlation between mea- 
surement results and the corresponding classical infor- 
mation for qubits prepared in the Accept/Reject basis 
confirms a client's Accept /Reject choice. Trent declares 
contract as valid, giving the signed certificates to both 
clients, if a client, say Alice, accepted the contract, while 
Bob did not reject it, or vice versa. Note that it is im- 
possible, unless with negligible probability, to produce 
perfect correlations on both sets of qubits (a direct con- 
sequence of the security \i3\ of the BB84 protocol [12'). 
In this and the next two sections we restrict ourselves 
to the case of ideal measurements and noiseless quantum 
channels (from Trent to the clients). The real-case sce- 
nario is discussed in the penultimate section of the paper. 

Obviously, the Exchange phase as described above suf- 
fers from the same problem as any classical protocol 
not involving information exchange with Trent: upon 
receiving Alice's results. Bob can stop communication 
and safely postpone his decision to accept or reject the 
contract to a later moment in time. Thus, we require 
that the measurements and the exchange of measure- 
ment outcomes between clients happens in steps, (qu)bit 
by (qu)bit. Nevertheless, if we require perfect correla- 
tions between the measuring results and the correspond- 
ing classical information for all qubits distributed to a 
client, in 1/4 of the cases an agent will be already after 
the first step in a position to choose to, with probability 
one, either bind or reject the contract. 

Imagine the following situation. Alice is the first to 



perform a measurement and send the classical informa- 
tion to Bob. She is the honest party, she wants to ac- 
cept the contract and thus she measures A onto her first 
qubit. With probability 1/2, her first qubit will be pre- 
pared in one of the states from the Reject basis. By 
measuring A onto one of the {| — ), |+)} states, there is 
1/2 of the probability that her result does not match the 
value of C^, and so with probability 1/4 Alice will not 
be able to achieve perfect correlations between her mea- 
surement outcomes and the corresponding classical data 
of the qubits prepared in states from the Reject basis. 
In other words, there is 1/4 of probability that an hon- 
est side will already after the first step of the Exchange 
phase be unable to reject the contract, even before the 
other side performed any measurement. In such a situ- 
ation. Bob can safely stop communication and postpone 
his choice until later moment in time. 

Thus, we require that in order to accept /reject the 
contract, a client has to establish perfect correlations 
on aNj^i^ qubits prepared in the Accept /Reject basis 
(with the total number of qubits N = Na + ^i?), where 
1/2 < a < 1. We call a the acceptance ratio (note 
that, for a protocol to be viable, it is necessary that 
a > 1/2). In this scenario, a client is allowed to obtain 
(1 — a)NA/R wrong results for the states prepared in the 
basis of her/his choice (Accept or Reject). If a is suffi- 
ciently large, this eliminates the possibility of obtaining 
good enough correlations for both groups of qubits, this 
way eliminating the above mentioned unfair situation. 

In the rest of this section, we present a formal descrip- 
tion of our protocol. Our protocol is optimistic and as 
such it is divided into three phases: the Initialization, 
the Exchange (see Fig. [T]) and the Binding phase. Dur- 
ing the Exchange phase agents exchange their measure- 
ment results. If both clients are honest and perform mea- 
surements according to the protocol (measure the Accept 
observable), the Exchange phase will end up with both 
clients having their probabilities to bind the contract ex- 
ponentially (in number of qubits) close to one: the proto- 
col is viable and optimistic (clients do not need to contact 
Trent as they already know the answer). If a client, say 
Bob, is dishonest and performs measurements other than 
that prescribed by the protocol (or just guesses the out- 
comes), he will unavoidably obtain wrong outcomes for 
some of the qubits from the Accept basis. If Alice de- 
tects a wrong result (Bob's cheating)^ she interrupts the 
exchange and proceeds to the Binding phase. In a real- 
istic case of measurement errors, Alice will have to set a 
threshold for the allowed number of wrong results below 
which she continues with the exchange. We discuss it at 
the end of this paper. 

The Initialization Phase: Trent produces N pairs of 
qubits in states {\i^)mA^)m) ^^^^ corresponding clas- 
sical description {C^,Cg) = {{Cf^,CfJ,{C^^,CfJ), 
with m G {1, . . .N}. The rule of assigning the classical 
data to the corresponding qubit states is the following: 
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The Initialization Phase 




Comparison Measurement 



FIG. 1: (color online) The Initialization and The Exchange 
Phase. 

C^^^ = I if \'4^)m^ ^ Ba, while C'^^^ = otherwise; 

Ctr = 1 */ mi^" e {|1), 1+)}, while cfS^ = oth- 
erwise. Each qubit state is randomly chosen from the 
56^ {|0), |1), |— ), 1+)}. Trent distributes to Alice N qubits 
IV^);^ and 2N classical bits C^, and analogously for Bob, 
keeping the copy of the classical data to himself He as- 
signs a unique identifier (number) to all data so that it 
can be linked in the Exchange phase to a specific contract. 

The Exchange Phase: Alice and Bob agree on a con- 
tract and exchange signed messages containing the con- 
tract, the identifier of qubits sequence they want to use, 
and some previously arranged moment in time to giving 
time restriction to finish the Exchange phase. (This does 
not bind them to the contract!) Alice and Bob perform 
measurements on their qubits and exchange the measure- 
ment results with each other. Without the loss of general- 
ity, we assume Alice is the first to start communication. 
She measures an observable of her choice (A or R) on 
the state obtaining the result Mj^ G {0, 1}; and 

sends it to Bob. Bob compares with Cf^. If the val- 
ues are different, Alice measured her qubit in the basis 
corresponding to {1 -\- Cj^) mod 2. Otherwise, the com- 
parison is inconclusive. Next, Bob repeats the procedure 
described for Alice. The rest of the exchange consists in 
repeating the above procedure for the states {\i^)mA^)m) 
with m G {2, . . . A^}. // a client, say Alice, does not ob- 
tain a result from Bob until to or receives for a qubit from 
the Accept basis a result different from the corresponding 
classical data (C^^ = 1 A 7^ immediately 
proceeds to the Binding phase. 

The Binding Phase: At the beginning of the Binding 
phase Trent chooses a G (1/2, 1) randomly and indepen- 
dently, according to a publicly known probability distri- 
bution p{a) . Without the loss of generality, we assume 
that Alice contacts Trent to decide validity of the con- 
tract. She decides according to her preference whether 



she want to bind or to reject the contract. In the for- 
mer case she measures all unmeasured qubits in the Ac- 
cept basis, in the latter in the Reject base. Both parties 
then report Trent for each respective qubit whether they 
measured it in the Accept or Reject basis, and submit re- 
spective measurement outcomes. Trent verifies whether 
their measurement outcomes correspond to their claims. 
If there is a mismatch in measurements of, say Bob, he 
is declared as cheater and Trent considers only Alice^s 
measurement outcomes. Let N-^ (^r) denote the num- 
ber of Alice ^s qubits prepared in the Accept (Reject) ba- 
sis, and analogously and for Bob. The contract 
is declared as valid if Alice presents at least aN^ accept 
results and Bob presents less than aN^ reject results, or 
when Bob presents at least aN^ accept results and Alice 
presents less than olN-^ reject results. In case a client, 
say Bob, supplied incorrect measurement outcomes (see 
above), Trent declares the contract to be valid if Alice 
presents at least aN^ accept results. In all other cases 
the contract is declared as invalid. 



III. FAIRNESS CONDITIONS 

As noted in the previous section, our protocol is (prob- 
abilistically) viable: if both clients are honest, the prob- 
ability to bind the contract is exponentially close to one. 
Therefore, it is also optimistic: honest clients do not need 
to contact Trent in order to obtain the verdict that, with 
exponentially high probability, they already know. In 
case a client, say Bob, is not honest, i.e. is not measur- 
ing the Accept observable in every step of the protocol, 
we say that he is cheating. Any cheating strategy will in- 
evitably have a non-zero probability of producing a wrong 
result on qubits from the Accept basis, thus allowing Al- 
ice to detect Bob's cheating and move on to the Binding 
phase. 

In case the Exchange phase is terminated due to cheat- 
ing detected, all we can predict is the probability that 
Trent declares the contract as valid. This probability de- 
pends on the moment when the exchange was aborted as 
well as on actions of both parties (before and after the ex- 
change was terminated). The preferences of the signing 
parties may change (due to commodity price changes, 
etc.) before it is possible to reach Trent. We say that 
parties are symmetric, if the probability that Trent de- 
clares the contract as valid is (almost) the same regard- 
less whether honest Alice wants to bind the contract and 
Bob wants to reject it, or vice versa. Note that we do 
not care about trivial cases when both want to reject or 
both to bind the contract. 

This notion of symmetry is close to the weak coin toss- 
ing problem [23 : if both Alice and Bob want the same 
outcome (0 or 1), there is no need to guarantee unbiased 
coin toss. On the other hand, it is vital to assure as little 
bias as possible, if their preferences are contradictory. 
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In this section, we present our formal fairness con- 
ditions that ahow for such symmetric positions of the 
chents. In the foUowing, we assume Ahce to be honest 
and Bob dishonest chent. 

The probability to bind the contract, Phind^ is a prob- 
abihty that during the Binding phase Trent, upon re- 
ceiving classical information from both Alice and Bob 
(i.e., their measurement results), declares the contract as 
valid and hands in to both Alice and Bob signed (i.e., 
validated) copies of the contract. 

The probability to bind is a function of step m, after 
which the communication is broken (typically, if cheating 
is noticed, or a connection between the clients broken). 
It is also a function of clients' strategies. In this section, 
we will consider the case of one-particle measurements 
only. As shown in section V., the general case of multi- 
particle measurements, acting on at most L qubits, can 
be reduced to the case of one-qubit measurements, by 
considering the blocks of L qubits as units and then ap- 
plying the same reasoning to the sequence of N/L such 
units. The case of global measurements on all N qubits 
is discussed at the end of Section V. 

Restricting ourselves to one-qubit measurements, for a 
fixed parameter a, the probability to bind is a function 
of clients' measurements before the step m, X*^ for Alice, 
for Bob, and their behavior after the step m, for 
Alice, for Bob. Thus, 

Pbind = Pbindim, a, {X^, X^), (F^, Y^)). (2) 

Alice is an honest client, so her strategy is X'^ = 
^0m^ In Section V. we show that, when measured on 
qubits prepared in one of the states from the Accept 
and the Reject bases, general one-qubit measurements 
produce probability distributions equivalent to those ob- 
tained when only the Accept and the Reject observables 
are measured. Therefore, Bob's strategy, in which he 
measures the A observable (m — Sm) times, while R 
observable is measured Sm times (the order is irrele- 
vant), is X^ = i®(m-<5m)^^(<5m)_ rpj^^g^ 

X^ = X^{m,6m). 

The only two relevant strategies after step m are those 
in which one client wants to bind the contract and the 
other does not want to bind the contract. The one 
who wants it bound measures the Accept observable, 
Y = i0(iv-m) rj.^^ Q^j^g^^ ^Yio does not want it bound, 
measures the Reject observable, Y = R^i^-m)^ if Al- 
ice wants the contract bound, F*^ = A^i^-'^)^ and 
Bob doesn't, Y^ = R^i^-^)^ we call the correspond- 
ing probability Alice's probability to bind the contract, 
P^^^(m, ce, X-^, X^), and analogously for Bob (note that 
in this notation, clients' strategies after step m are not 
explicitly written). We will calculate clients' probabili- 
ties to bind the contract in the next section. Here, we 
only note that we do not discuss cases when after step m 
both clients want the same: if the protocol is fair for the 



cases when clients' wishes are opposite (a conservative 
assumption), it will be when they wish the same. 

Averaging over all possible Bob's strategies X^ (Alice 
is honest, so her strategy is known), we obtain 

Pbtdim^a) = ^K^^)nt,(m,a,X^,X^), (3) 

and analogously for P^-^^{m,a). Here, p{X^) is the 
probability that Bob chooses the particular strategy 
X^ = X^{m,Sm), and is given by the probability 
Pw{Sm) = 1 — (3/4) to obtain a wrong result, when 
measuring the Reject observable Sm times (obviously, 
wrong results are, in the case of ideal measurements with 
no errors, possible only on qubits from the Accept basis). 

For our protocol to be fair, we require that at each 
step m of the Exchange phase, the difference between the 
agents' (Alice and Bob) probabilities to bind the contract 
can be made arbitrarily small: for any given 

\Phind{m, a) - P^ndim, a)\ < e. (4) 

In order to make our protocol even more symmetric, 
we introduce the probability to cheat of a dishonest client 
(Bob). It is the product of Bob's probability to bind, and 
the probability that Alice will not bind the contract: 

Pf^(m,a,X-^,X») = P,l,(m,a,X-^,X«) (5) 
x[l-P,t^(m,a,X^,X^)]. 

After the averaging over Bob's strategies X^{m) prob- 
ability to cheat of a dishonest client Bob is: 

Pf,(m,a) = ^p(X^)Pf,(m,a,X^X^). (6) 
x^ 

Our second fairness requirement is that a dishonest 
client's (Bob's) probability to cheat P^^{m, a) is also neg- 
ligible^. Note that in our protocol the Binding phase 
requires both clients to confront their measurement re- 
sults, both obtaining the same verdict by Trent at the 
end. Therefore, although the probability to cheat is the 
product of two probabilities, the probability that Bob can 
bind the contract and the probability that Alice cannot, 
it is not itself a probability of an event (Bob's probability 
to bind is obtained under the assumption that after step 
m he measures A and Alice R\ to obtain Alice's prob- 
ability to bind, we assume that after step m she is the 
one to measure A while Bob measures R). Yet, it can 
serve as a measure of protocol's fairness as it quantifies 
agent's freedom to choose between binding and refusing 



Obviously, if the second fairness requirement is satisfied, the 
first if satisfied as well: having negligible probability to cheat 
is stronger condition than the symmetry between the client's 
probabilities to bind the contract. 
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the contract later in time. We discuss this in more de- 
tail at the end of this section. At the end of the paper, 
we show that it is straightforward to design a protocol in 
which it is not necessary that both clients are (simultane- 
ously) present during the binding phase. In this scenario, 
the corresponding probability to cheat becomes the joint 
probability that one client can bind the contract, while 
the other cannot. 

Unfortunately, although the first fairness criterion is 
satisfied for the above protocol, its probability to cheat 
can be as high as 1/4: in case both clients measure the 
Accept observable, both clients' probabilities to bind are 
monotonic functions, such that for big enough there 
exists rus for which P^ridi^s.o^) « Pbindi^s.a) « 1/2. 
But if a, determined by Trent by sampling a random 
variable described by a publicly known probability dis- 
tribution p{a), is itself unknown to the clients, and deter- 
mined only later during the Binding phase, the expected 
probability to cheat Pc/i(^) becomes negligible, for big 
enough N. Thus, our second fairness condition finally 
reads as: for any given 

Pchim) = J p(a)P,lrf(m,a)[l-P,t<i(m,a)]da<e. (7) 

The coefficient a is sampled randomly by Trent to achieve 
stronger security requirements. This assures symmetric 
position of honest and cheating participant even before 
Trent is contacted during the Binding phase: if agents 
are temporarily unable to contact Trent, cheaters should 
not profit from this in a significant way. 

A client, say Bob, may be willing to take the risk 
and stop the protocol prematurely during the Exchange 
phase, provided such a situation can assure him some rea- 
sonable position. Consider a contract where Alice buys 
orange juice from Bob for X units per litter. According 
to the market expectation, with probability p the price 
should increase and with probability {1 — p) decrease. 
When the price goes up to X' > Alice wants to en- 
force the contract, since otherwise she should buy juice 
for higher price. Bob wants the contract to be canceled 
to sell the juice for higher price. In case the price drops, 
the situation is symmetric. 

Bob may be willing to take the risk parameterized by 
S in the following sense. The joint probability that the 
price drops and he will be able to enforce the contract is 
at least 6 as well as the joint probability that price in- 
creases and Alice won't be able to enforce the contract. 
The latter gives him protection from financial loses, while 
the former allows him to spare some money. This is for- 
malized as 

{3 0<p<l) Hi -PfclJ > S A (1 -p)P,l, > S] . (8) 

Thus, to prevent reasonability of Bob's cheating we re- 
quire that 

(VO<p<l) [p{l - P,td) < ^ V {l-p)PLd < . (9) 



Let us denote Y = P^^^^(m, a)[l - P^^^i^, a)] the ran- 
dom variable parameterized by a. The expected value 

EiY) = J p{a)P^^^im, a)[l - Pj^^m, a)]da (10) 

is nothing but the expected probability to cheat Pchi'rn) 
(note that due to P^-^^{m,a) ^ P^^^{m,a), we have 
Pchi'm) = Pchi^) ^ ^chi^) )' Using the above fairness 
criterion Pchi"^) < ^, Chebyshev inequality, and putting 
^3 = we obtain Probe, [F < S -\- S^] > 1 - S. Thus, the 
probability S can be made arbitrarily small with arbitrar- 
ily high probability. 

IV. FAIRNESS OF THE PROTOCOL: IDEAL 
CASE 

In the following, we show that our protocol is fair, both 
l^bindi^^ ^)-Pund{^^ ^)l Pch{m) could be made ar- 
bitrarily low. In this section, we assume that only Aor R 
are measured, and that no measurement errors or qubit 
state corruption occur. In the next section, we discuss 
general (one or multi-qubit) observables and real-life sce- 
nario of imperfect measurements and noisy channels. 

In case Bob is cheating during the Exchange phase, he 
will be detected after a small number of steps, with prob- 
ability growing exponentially in the number of qubits 
measured by Alice. Assume Bob's cheating is detected 
after Alice measured m qubits. Alice terminated the Ex- 
change phase and participants proceed with the Binding 
phase, that can be delayed (Trent is offline). Meanwhile, 
participants are allowed to change their preferences and 
we would like to examine symmetry of their position. We 
are interested only in the situation when Alice wants to 
bind the protocol and Bob wants to reject, and vice versa. 

In the former case Alice tries to do her best to bind 
the contract. This means she measures all unmeasured 
qubits in the Accept basis and sends her results to Trent. 
Bob does his best to invalidate the contract, measuring 
his qubits in the Reject basis. Note that possible lying 
about measurement basis on respective qubit is detected 
with probability growing exponentially in the number of 
wrongfully reported measurement results, so the number 
of measurements Bob can lie about is well limited. 

If the cheating was detected and the Exchange phase 
was terminated after m steps, Alice's probability to bind 
the contract is, for a given a, given by the following ex- 
pression: 

P,t<i(m, a, X^, X") = P^{m, a, X-^)[1-P|(m, a, X^)], 

(11) 

and analogously for Bob. Probability to accept the con- 
tract. Pa, is the probability that a client who wants the 
contract bound, thus after step m measuring the Accept 
observable, will pass the Trent's test during the Bind- 
ing phase. Probability to reject the contract, Pr, is 
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the probability that a cHent who does not want the con- 
tract bound, thus after step m measuring the Reject ob- 
servable, will invalidate the contract during the Binding 
phase. Note that under this convention it is redundant 
to specify clients' strategies Y after the step m. Also, 
clients' probabilities to accept and reject the contract de- 
pend only upon their own strategies before the step m, 
and not those of the opponent. 

Alice's probability to accept the contract is 
P^(m,a) = 1: she is an honest client and thus is 
measuring A in every step until the interruption; she 
wants the contract bound, so continues to measure 
the Accept observable. Her probability to reject the 
contract can be written in a simplified form as P^(m, a), 
bearing in mind that in this case X'^{m) = A^'^ and 

Out of m steps, a dishonest Bob measures the Ac- 
cept observable (m — dm) times, and the remaining dm 
times the Reject observable. Therefore X^{m^5m) = 
j^®{m-5m) fi®{5m) ^ ^j^^^ rejecting the contract, his 
strategy is Y^{m) = R^i^-^)^ and we see that Bob's 
probability to reject is the same as Alice's probability 
to reject, had the interruption occurred 5m steps be- 
fore, P^{m,a,6m) = P^{m — Sm^a). When measuring 
the Reject observable, the probability to obtain wrong 
results on states from the Accept basis, and thus be- 
ing detected cheating, is exponentially fast approach- 
ing to one, Pw{Sm) = 1 — (3/4) Therefore, for 
1/2 < a < 1 and large enough TV, Sm << (1 — a)N. 
The expected 6m is small and since for large enough TV 
all the probabilities are slow functions of m, we have 
P^{m^a^Sm) ~ P^{m^a) = 1, while P^{m^a) ~ 
P^{m — Sm^a) = P^{m^a). Therefore, the first fair- 
ness condition P^^^{m^a) ~ P^-^^{m^a) is satisfied. 

To show that the second fairness condition is also sat- 
isfied, we first note that, due to P^(m,a) ^ P^(m,a) 
and P^(m, a) ~ P^(m, a) = 1, the two probabilities to 
cheat are almost the same and can be, for a given a, 
written in terms of single expected probability to reject 
the contract 

Pch{m; a) = PR{m; a){l - PR{m; a)). (12) 

The expected probability to reject, for a given a, is 

N 

PR{m;a)= ^ q{NR)PR{m; a, Nr), (13) 

Nr=0 

where PR{m] Nr) is the probability to (be able to) 
reject the contract (obtain less than (1 — a)NR wrong 
results on qubits from the Reject basis, measuring the 
Accept observable on the first m qubits), for a given ac- 
ceptance ratio a and the number of qubits prepared in 
the Reject basis Nr^ keeping for simplicity the N depen- 
dence implicit, and q{NR) = ^ ^ ^ is the proba- 
bility to have exactly Nr states from the Reject basis. 



Note that PR{m]a^ Nr) is calculated under the assump- 
tion that the Accept observable is measured during the 
first m steps, while after that the Reject observable is 
measured for the remaining {N — m) steps. 

For m < (1 — a)NR there is always a chance to reject 
the contract, thus PR{m;a^ Nr) = 1. Otherwise, 

PR{m; a, Nr) = ^ P{n in R; m, NR)PR{n in R; a, Nr). 

n=n' 

(14) 

Here, the probability that exactly n out of the first m 
qubit states are from the Reject basis is given by^ 



P(n in R; m, Nr) = 



m\ ( N — m 



n J \ Nr-u I \ Nr I 



(15) 

while the probability of being able to reject the contract 
if n qubits are from the Reject basis is given by^ 



PR{n in R;a,TV^) =2-"^ 



n 



(16) 



where T = (1 - a)NR - 1 if n > (1 - a)NR and T = n 
otherwise. Due to the constraint of having exactly Nj^/r 
qubits from the Accept/Reject basis, the range of the 
summation for n in equation (14) is given by = for 
m < Na while n' = m — Na otherwise, and m' = m for 
^ ^ Nr while m' = Nr otherwise. 

Finally, the expected probability to cheat, with respect 
to a given probability distribution p{a) on the segment 
la, is 

Pch{m) = / p{a)Pch{m;a)da. (17) 

Using the simplest uniform probability p{a) = I /la on 
the segment la = [0.9,0.99], we numerically evaluated 
the expected probability to cheat PchiTn) for up to = 
600, while for the "typical" case of Na = Nr we managed 



^ Since each sequence of qubit states, prepared such that exactly 
Nji are from the Reject basis, is equally probable, the probability 
P(n in R; m) is given by the ratio of the number of sequences 
whose n out of Nji qubits prepared in the Reject basis are among 
the first m qubits, while the other (Npi — n) are among the rest 

of (A^ — m) qubits, ( ^ ) ( ^ ) , and the total number of 



Nr-u 



allowed sequences is 



Nr 



^ When measuring the Accept observable A on a state from the 
Reject basis each of the two possible results are equally probable. 
Therefore, each sequence of n such measurement results has the 
probability . If exactly i out of n individual-qubit results 
do not match those given by Trent to the other client, and if 
i < {1 — a)N, then it is still possible to reject the contract. 



There are 



of such measurement results, for given n. 
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to evaluate it up to = 8000, see Fig. |2j We see 
that the fairness condition sup^Pc/i(^) << 1 is satisfied 
(for N = 600 we got sup^Pch{m)_= Pch{^2) = 0.0811, 
while for Na = Nji we have sup^Pc/i(m) = Pc/?, (1455) 
0.02 17 for N = 8000), which is explicitly shown on Fig. |2l 
Moreover, the numerical fit gives sup^Pc/i(m) cx N~'^ 
behavior, giving us the scaling of the complexity of the 
protocol, with respect to the number N of exchanged 
messages between Alice and Bob. 
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FIG. 2: (color online) The expected probability to cheat 
Pch{m) (upper row) and the maximal expected probability 
to cheat sup^ Pc^(m) (lower row) for the uniform p{a) on 
la = [0.9,0.99]. The plots from the left column represents 
results for our protocol, while the right ones are for the 
restricted "typical" case of Na — Nr. Note the scaling 
behavior sup^Pc^(m) oc N~^^'^ . 



V. FAIRNESS OF THE PROTOCOL: GENERAL 
MEASUREMENTS AND NOISE 

First, we consider only one-qubit orthogonal measure- 
ments. Since Alice is an honest client, X'^ = A*^^, 
we have that P^(m,a,X'^) = 1 and P^(m,a,X'^) = 
PR(m,a). 

Bob is a dishonest client and his strategy consists 
of measuring (m — k) times the Accept observable A and 
k times observable K = ■\m){m\-\-l- |m^)(m^|, where 

|m) =cos ^|0)+e^sin ^|1) =cos ^|-)+e^sin ^|+). (18) 

Let m = ma-\-mr^ where rria is the number of the Accept 
and rur the number of the Reject qubits among the first 
m qubits, and let ka be the number of measurements of 
K on rria qubits from the Accept basis, and analogously 
for kr. Bob's measurements of K are equivalent to^ (for 
simplicity, we omit writing the a and Nr dependences): 



• Qa - ka measurements of A and drria = [1 — Qa] • 
measurements of R on qubits from the Accept 
basis, where qa = cos 6. Thus, the probability 
to notice cheating after ka measurements of K 
is PU^rUa) = p^([l - qa]ka) = 1 - (l/2)[i-^«]^^ 
and Bob's probability to accept the contract is 
Pf (m, a, X^) PA{m, a; rria, ^rria); 

• Qr ■ kr measurements of A and 5mr = [1 — Qr] • kr 
measurements of R on qubits from the Reject ba- 
sis, where Qr = cos^^ Thus, Bob's measurements 
are equivalent to (m^ — 5mr) measurements of A 
on qubits from Reject basis and his probability to 
reject is P^(m, a, X^) < PR{m — Srrir, a). 

Since Pw{^^a) = 1 — (1/2) t-^"^^]^'^, either ka is small, or 
Qa ^ 1. In case of ^ 1, we have that Qr ^ 0: the ob- 
servable K is close to A and Bob's strategy is close to that 
of an honest client. In case, ka is small, we have that Srrin 
is also small and Bob's probability to accept the contract 
is close to one, P^{m^ X^) = PA{m, a^rria, Srria) ^ 1. 
Moreover, since for typical cases ka ^ kr, we have 
that typically Bob's probability to reject the contract 
is P^{m^a,X^) ^ PR{m^a). Therefore, the corrected 
probability to cheat, averaged over all possible distribu- 
tion of states (from the Accept and the Reject bases) and 
all possible strategies of the clients, will not be consider- 
ably altered and the protocol would still be fair, even if 
arbitrary number of observables Ki is allowed. Note that, 
according to the above and the analysis from the previ- 
ous section, the complexity of the protocol, for the case 
of general one-qubit orthogonal measurements, scales as 
N oc e"^, where N is the number of exchanged messages 
and e a given upper bound for the probability to cheat. 

The above argument could be generalized for joint L- 
qubit measurements, if L cx A^^ and t < 1: for every joint 
observable (or general POVM) Ol ^iLi^i there is a 
non-zero probability ql that at least one wrong result 
will be obtained on the accept qubits, which scales as g^. 



First, we consider measurements of K on qubits whose states 



are from the Accept basis. Let Pfc(0|0) be the conditional prob- 
abihty to obtain result when measuring an observable K on 
the state |0}, and analogously for other conditional probabilities. 
Notice that, when measuring an arbitrary one-qubit orthogonal 
observable K, one has p(0|0) = = Sa- the probabilities to 

obtain the right result on the states from the Accept basis are the 
same. The two probabilities are also equal when one measures A 
with frequency (i.e., probability) qa and R with frequency 1 — qa- 
The probability to obtain the right result on the states from the 
Accept basis is then Sa = ga + (1 — ga)/2 = (1 + ga)/2: when 
measuring A (with probability qa) one obtains the right result 
with probability 1, while when measuring R (with probability 
1 — qa) one obtains the right result with probability 1/2. In or- 
der for those two measurements to be equivalent, it is necessary 
that Sa = Sa = {1 + qa)/'2. In the case of the orthogonal observ- 
able K, we have Sa = cos^(^/2), and thus qa = cosO. The same 
argument applies for the case of measurements performed on the 
states from the reject basis. 



10 



k being the number of Ol measurements (note that for 
ideal measurements, Ahce wih notice cheating as soon 
as she receives the first wrong result from Bob). Thus, 
in case of performing joint measurements on at most L 
qubits, for N/L >> 1, the protocol would still be fair. 

In case L oc N the fairness of our protocol could be 
seen as a consequence of the unconditional security of the 
BB84 protocol in the presence of noisy channel and im- 
perfect sources and detectors [13 : if we interpret {I — a) 
as the error rate due to the noise (see the paragraph 
below), then in order to successfully cheat in our con- 
tract signing protocol, an agent would have to be correct 
on both aNA qubits from the Accept basis and on aNn 
qubits from the Reject bases, which in turn contradicts 
the unconditional security of the BB84 protocol. Namely, 
in order to pass the test by Alice and Bob and thus learn 
the secret key. Eve has to know the states of qubits from 
both mutually unbiased bases. In the presence of errors, 
she needs to be correct only on the a fraction of qubits. 
Since quantum cryptography is unconditionally secure, 
that is not possible, unless with exponentially small prob- 
ability. Thus, our quantum contract signing protocol is 
fair. Note that, although the errors due to imperfect tech- 
nology are inevitable, it is possible, at least in principle, 
to make them arbitrary low. Therefore, if for some error 
rate (l — a) it is not possible, unless with negligible prob- 
ability, to have the right results on aN^/R qubits from 
both the Accept and the Reject bases, then for some bet- 
ter equipment the fairness condition would be satisfied. 

In the case of measurement errors and noisy chan- 
nels, one must introduce the error tolerance r] = My^/M^ 
where = (m^^) = 77M is the expected number of 
wrong results obtained in measuring an observable on M 
qubits prepared in states from the observable's eigenba- 
sis. Coefficient r] gives the ratio of unavoidably produced 
wrong results: to detect cheating would then mean to ob- 
tain more than expected, according to 7^, wrong results. 
For T] < (l — a) and big enough our protocol would 
therefore still be fair. 

Our protocol can be modified to use only two non- 
orthogonal pure states, just like the B92 cryptographic 
protocol [24] is modified after the BB84. Obviously, the 
probabilities determining the features and complexity of 
the protocol would be quantitatively different, but the 
protocol would clearly still be fair. 

We note that it is straightforward to design a proto- 
col in which a single client can contact Trent to obtain 
a signed contract. In this case, Trent sends to a client, 
say Alice, classical information about only a half of, ran- 
domly chosen, Bob's qubit states. This information is 
used by Alice to check Bob's measurements: whether he 
is measuring the Accept observable, or not. If so, he is 
measuring the Accept observable on the rest of his qubits 
as well (he does not know for which qubits Alice has the 
classical information and for which not). Thus, the re- 
sults Bob provided her for the rest of his qubits is used 



by Trent to verify Alice's data: instead of Bob appearing 
with his results, Alice provides those given to her by Bob. 
Note that in this case, unlike before, the corresponding 
average probability to cheat is probability of a real event: 
joint probability that an agent cannot bind the contract, 
while the other can. 

This version of the protocol is also suited for the use of 
entangled pairs, instead of qubits in definitive pure states. 
In this case, Trent produces AN pairs of maximally entan- 
gled qubits in the singlet state = (|01) - \10))/V2. 
Half of each pair of the first 2N entangled pairs are dis- 
tributed to Alice, while the other half is kept with Trent. 
Each half of the other 2N pairs is sent to Bob. Then, 
Trent randomly measures either of the two observables 
(Accept or Reject) on each of AN qubits left with him. 
Random results obtained from measuring the first 2N 
qubits are sends to Bob (together with the classical infor- 
mation of their positions within the first 2A^ pairs), and 
analogously with the other 2N results {N of which are 
sent to Alice). We see that this situation is equivalent to 
the above, when instead of entangled, Trent sends qubits 
in pure states. 

Finally, we note that it is simple to generalize our pro- 
tocol for the case of arbitrary number of parties. In case 
of n parties, a classical information about the prepara- 
tion of each of N qubits sent to, say the first client, is 
divided into N/{n — 1) sets 5'^, with i = 2,...n, such 
that each set Si is sent to the i-th client. The protocol 
is executed in N rounds, such that in the i-th step of 
each round, the i-th client is performing a single-qubit 
measurement and publicly announces the result to all of 
the remaining (n — 1) clients. To declare contract valid, 
t binding all of the n clients, the requirements analogous 
to the ones for the two-party protocol must be satisfied 

between each of the ^ 2 ) pairs of clients. This, as well 

as the above mentioned generalizations of our protocol, 
will be discussed in more detail elsewhere. 



VI. CONCLUSIONS 

We have presented a fair and optimistic quantum pro- 
tocol for signing contracts that does not require the ex- 
change of information with the trusted party during the 
Exchange phase. Unlike the classical proposals, its fair- 
ness is based on the laws of physics rather than on send- 
ing signed messages, that are only computationally se- 
cure. Thus, no keys are generated during the Exchange 
phase and the protocol is abuse-free. For single-qubit 
orthogonal measurements, the complexity of the proto- 
col scales diS N (X e"^, where N is the number of ex- 
changed messages and e given threshold for the proba- 
bility to cheat. Analogously to the previous proposal of a 
quantum contract signing protocol [2F, the present one 
could also be performed using either entangled pairs or 
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two, instead of four pure states, but it does not require 
tamper-proof devices nor is based on the effects of deco- 
herence (which are necessary for achieving [IS])- Also, 
it is simple to generalize it to involve many clients. Our 
protocol can easily be altered such that only one client 
is enough to present her/his results in order to bind the 
contract and obtain the document declaring the contract 
as valid. In this case, the probability to cheat becomes a 
joint probability that a client can bind a contract, while 
the other cannot. The fairness condition of a negligible 
probability to cheat is in this case slightly weaker than 
the one of 0- Also, in our quantum protocol the trusted 
party is slightly more involved than in the classical pro- 
tocol presented in [6 . Nevertheless, being based on the 
laws of physics, our protocol has other security advan- 
tages over the classical counterparts. Moreover, it can be 
used for designing other quantum information and secu- 
rity protocols. Indeed, our approach was used to design 
the protocols of simultaneous dense coding and telepor- 
tation between spatially distant clients [11 . Finally, our 
protocol could be easily performed with the current tech- 
nology used in quantum cryptography. 

The possible future lines of research include a detailed 
study of the effects of noise and multi-particle measure- 
ments on the fairness of the protocol and its complexity. 
Today's quantum technology is still at its infancy and 
experimental realizations and technological applications 
of quantum information protocols are relatively rare and 
not always as reliable as classical alternatives. Even the 
security of quantum cryptography, that is proven to be 
unconditionally secure under the effects of noise, is still 
very much dependent on the technology used. Neverthe- 
less, the development of quantum technology has already 
proven to be remarkable and beyond many of early expec- 
tations, and will for sure continue to develop. Another 
possible line of future research could be a further study of 
alternative versions of quantum contract signing proto- 
cols with possibly better properties and designing novel 
quantum information, security and computation proto- 
cols involving spatially distant clients that require timely 
decisions. 
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